104.28.154.8📋 Copy

# IP Intelligence Briefing: 104.28.154.8/32

## Executive Summary

IP 104.28.154.8 is a Cloudflare CDN edge node classified as Moderate Risk (Score: 40). The IP belongs to CLOUDFLARENET (ASN 13335) with infrastructure located in the United States. While the IP shows DNSBL listings and moderate risk scoring, the parent subnet demonstrates low abuse density (0.0741) with minimal threat presence.

## Technical Profile

Ownership & Infrastructure

• Organization: Cloudflare, Inc.
• ASN: 13335 (CLOUDFLARENET)
• CIDR Block: 104.16.0.0/12
• Abuse Contact: abuse@cloudflare.com
• Geolocation: United States (New York region)
• Network Role: Firewalled / No Services

Risk Indicators

• Overall Risk Score: 40 (Moderate)
• DNSBL Listed: 2 of 8 total lists
• Abuse Confidence Score: Not available
• Known Attacker: No
• Tor Exit Node: No
• Spam Source: No

Network Classification

• Provider Score: 0
• Authority Score: 0
• Infrastructure Type: CDN/Edge Network
• Service Purpose: Firewalled / No Services
• Certificate Status: No TLS certificate detected
• Open Ports: None detected

## Neighborhood Analysis (104.28.154.0/24)

• Total Siblings: 27 IPs
• Active Siblings: 13
• Threat Siblings: 2
• Abuse Density: 0.0741 (Low)
• Subnet Classification: mostly_clean
• Risk Distribution: 0 High, 6 Medium, 19 Low

The parent subnet exhibits minimal threat presence. Most sibling IPs maintain low-to-medium risk scores (0-55), consistent with Cloudflare CDN infrastructure patterns.

## Observation History

Fourteen observations recorded with consistent Cloudflare ownership signals. Recent probes (2026-07-28) confirm:

• Stable ownership (0 ownership changes)
• No persistent threat activity (0 threat persistence days)
• Geographic signals consistently identify US origin
• Geolocation validation shows some uncertainty (accuracy radius: 2500km)

## Relationship Graph

Single relationship identified: Same Network (CLOUDFLARENET). No external organizational or certificate associations detected.

## Recommended Security Actions

Based on risk score 40 and DNSBL listings, the following firewall rules are recommended:

Firewall Rules

• iptables: `iptables -A INPUT -s 104.28.154.8 -j DROP`
• nftables: `nft add rule inet filter input ip saddr 104.28.154.8 drop`
• nginx: `deny 104.28.154.8;`
• pfSense: `104.28.154.8/32`

WAF Integration

• Cloudflare WAF: Block expression `ip.src eq 104.28.154.8`
• AWS WAF: Address `104.28.154.8/32` with description "IPDebrief risk 40"

## Assessment

This IP represents a Cloudflare edge node with moderate risk scoring primarily driven by DNSBL listings. The subnet context suggests legitimate CDN infrastructure with low abuse density. SOC analysts should weigh the moderate risk score against the known Cloudflare service purpose and low neighborhood threat indicators before applying blocking rules. The firewall recommendations provided are probabilistic and should be evaluated alongside additional threat intelligence signals.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.